CVE-2022-34386

Vulnerability

Dell SupportAssist for Home PCs (version 3.11.4 and prior) and SupportAssist for Business PCs (version 3.2.0 and prior) contain a cryptographic weakness vulnerability [1]. The flaw resides in the cryptographic implementation used by the software, potentially allowing an attacker to compromise the confidentiality of sensitive data.

Exploitation

An attacker must have local access to the system and be authenticated as a non-admin user. No user interaction is required beyond the attacker's own actions. The attacker can exploit the cryptographic weakness to obtain sensitive information that should be protected.

Impact

Successful exploitation leads to disclosure of sensitive information (confidentiality impact is high). Integrity and availability are not affected. The attacker gains access to data that could include credentials or other protected data.

Mitigation

Dell has released security updates for SupportAssist for Home PCs and SupportAssist for Business PCs. Users should update to the latest versions available from Dell's support site [1]. No workarounds are documented.